不要把 agent 护栏放在 system prompt 里

Coding agents write, refactor, and open pull requests at a pace humans can't match. The instinct is to stuff safety into the system prompt: "never push to main," "don't touch secrets," "always run the tests." That feels like control. It isn't. A system prompt is advice to a model. Models are trained to follow instructions, and they are also trained to be helpful. When those goals collide, helpful often wins. A determined user, a long thread, or a cleverly worded task can dilute or override the rules you thought were hard-coded. Even without adversarial pressure, prompt-only guardrails drift. Every time you tune tone, add a workflow, or paste more context, you change the same surface that was supposed to enforce policy. If your safety depends on the model remembering to behave, you don't have a control plane. You have a suggestion. Why prompt-only guardrails fail in practice Three failure modes show up again and again. First, prompts are soft. They sit in the same channel as user messages and tool output. There is no separate enforcement path. A policy that lives only in text can be negotiated, forgotten, or reinterpreted. Second, prompts are hard to operate. You can't gradually expose a new rule to 5% of agents, measure whether it reduces bad tool calls, and roll it back in one click. Changing a prompt usually means redeploying config for everyone at once. That is the opposite of how mature teams ship risky behavior. Third, prompts don't produce evidence. When something goes wrong, you need to know which control failed. A buried sentence in a 2,000-token system message rarely leaves a clear audit trail. External controls can log a deny, a blocked tool call, or a failed policy check. An ignored instruction usually just looks like "the agent did a weird thing." What "outside the prompt" actually means External guardrails live in the layers around the model, not inside its instructions. Think in four buckets. Permissions Decide what the agent is allowed to invoke before it speaks. Tool allowlists, deny lists, and scoped credentials belong here. If the agent cannot call git push --force or read production secrets, you don't need the prompt to politely refuse. Scope Limit where the agent may act: which repos, branches, environments, and file paths. Narrow blast radius by default. Broaden it deliberately. Release Treat agent-generated change like any other risky change: expose a small slice first, watch live signals, and reverse when those signals degrade, before the blast radius grows. Deploy behind a switch. Expand when signals look healthy. Pull it back without a rebuild when they don't. The agent can still move fast; you decide who feels the impact. Measurement Watch quality, cost, error rate, and review outcomes. When a new agent config or tool policy regresses those signals, pause or revert. Judgment without measurement is optimism. The system prompt still has a job. Use it for style, priorities, and how to reason about the task. Put the hard limits where a process—not a paragraph can enforce them. A practical control stack for coding agents You don't need a perfect architecture on day one. A useful starter set looks like this: Separate policy from personality. Keep the system prompt focused on how the agent works. Move "must / must not" rules into config that your runtime or CI checks independently. Default to least privilege on tools. Start with read-only where you can. Require explicit elevation for write, merge, deploy, and secret access. Log every elevation. Gate high-impact actions. Before the agent merges, deletes, or talks to production, run a policy check or human approval step that the model cannot skip by rephrasing the request. Ship agent output behind progressive release. Whether the change is a feature, a refactor, or a prompt-driven config, release it the way you release anything else that might hurt customers: small, observable, reversible. Instrument the boring failures. Track blocked tool calls, policy denials, failed tests after agent PRs, and rollback events. Those numbers tell you whether your guardrails are real. Teams that already wrap risky human-written code in flags and progressive delivery already know this pattern. Coding agents just raise the volume. The same control infrastructure that makes fast shipping safe for people makes fast shipping safe for agents. What to try this week Pick one coding agent workflow you already trust enough to use daily. Map every irreversible action it can take. For each one, ask: does a prompt ask it not to, or does something outside the model prevent it? Move the top three irreversible actions behind an external check. Leave the prompt alone for tone and task framing. You will learn more from three hard denials you can measure than from thirty soft rules the model might follow. Closing System prompts are guidance. Guardrails are infrastructure. If you want coding agents to move quickly without inheriting silent failure modes, put the limits where you can observe them, change them, and reverse them...outside the prompt.